¡¾Îó²îͨ¸æ¡¿XWiki Details SummaryºêÔ¶³Ì´úÂëÖ´ÐÐÎó²î(CVE-2025-65036)

Ðû²¼Ê±¼ä 2025-12-08

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

XWiki-pro-macros Details SummaryºêÔ¶³Ì´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2025-65036

Îó²îÀàÐÍ

RCE

·¢Ã÷ʱ¼ä

2025-12-8

Îó²îÆÀ·Ö

8.3

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


XWikiÊÇÒ»¸ö¿ªÔ´µÄÆóÒµ¼¶ÖªÊ¶ÖÎÀíºÍЭ×÷ƽ̨£¬£¬£¬ÔÊÐíÓû§½¨Éè¡¢ÖÎÀíºÍ¹²ÏíÄÚÈÝ¡£¡£¡£Ëü»ùÓÚJavaºÍHibernate¹¹½¨£¬£¬£¬¾ßÓÐǿʢµÄ¿ÉÀ©Õ¹ÐÔºÍÎÞаµÄȨÏÞ¿ØÖÆ»úÖÆ£¬£¬£¬Ö§³Ö×Ô½ç˵À©Õ¹ºÍ¼¯³É¡£¡£¡£XWikiÖ÷ÒªÓÃÓÚÎĵµÖÎÀí¡¢ÏîĿЭ×÷ºÍ֪ʶ¿â½¨É裬£¬£¬ÆÕ±éÓ¦ÓÃÓÚÆóÒµ¡¢×éÖ¯ºÍ¿ª·¢ÕßÉçÇø¡£¡£¡£ËüÌṩÁ˸»ºñµÄ²å¼þºÍÄ£°å£¬£¬£¬¿ÉÒÔÖª×ã²î±ðÆóÒµµÄÐèÇ󣬣¬£¬²¢Ö§³Ö¶àÖÖÃûÌõÄÄÚÈÝչʾ¡£¡£¡£XWikiµÄ¿ª·ÅÔ´´úÂëʹµÃÓû§¿ÉÒÔ×ÔÓɶ¨ÖƲ¢¾ÙÐжþ´Î¿ª·¢¡£¡£¡£


2025Äê12ÔÂ8ÈÕ£¬£¬£¬c7c7ÓéÀÖÆ½Ì¨¼¯ÍÅVSRC¼à²âµ½XWiki-pro-macros Details SummaryºêÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¬£¬£¬Ó°Ïìcom.xwiki.pro:xwiki-pro-macros-confluence-bridges-ui°ü£¬£¬£¬¸ÃÎó²îÔ´ÓÚConfluenceµÄDetails SummaryºêµÄʵÏÖÎÊÌ⣬£¬£¬ºêÔÚÖ´ÐÐVelocity¾ç±¾Ê±Î´¾ÙÐÐÊʵ±µÄȨÏÞ¼ì²é£¬£¬£¬µ¼ÖÂδÊÚȨµÄÓû§Äܹ»Í¨¹ý½á¹¹Ìض¨Ò³ÃæÄÚÈÝ£¬£¬£¬´¥·¢Ô¶³Ì´úÂëÖ´ÐС£¡£¡£¹¥»÷Õß¿ÉÒÔͨ¹ý½¨ÉèÒ»¸ö°üÀ¨Groovy´úÂëµÄÒì²½ºêµÄÏêÇéºêÒ³Ãæ£¬£¬£¬ËæºóÓÉÖÎÀíÔ±½«¸ÃÒ³ÃæÍ¨¹ýDetails Summaryºê°üÀ¨µ½ÆäËûÒ³ÃæÖУ¬£¬£¬´Ó¶øÖ´ÐжñÒâ´úÂë¡£¡£¡£¸ÃÎó²î¿Éµ¼Ö¹¥»÷ÕßÔÚûÓбà³ÌȨÏÞµÄÇéÐÎÏ£¬£¬£¬Í¨¹ý½á¹¹Ìض¨Ò³ÃæÄÚÈݾÙÐжñÒâ²Ù×÷£¬£¬£¬´Ó¶øÔÚϵͳÖÐÖ´ÐÐδ¾­ÊÚȨµÄ´úÂ룬£¬£¬½ø¶øÎ£º¦ÏµÍ³Çå¾²¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


xwiki-pro-macros <= 1.27.0


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´²¹¶¡£¬£¬£¬ÒÔÐÞ¸´¸ÃÎó²î¡£¡£¡£
xwiki-pro-macros >= 1.27.1


ÏÂÔØÁ´½Ó£ºhttps://github.com/xwikisas/xwiki-pro-macros/tags/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£
ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£
ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£
ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£
ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-472x-fwh9-r82f/
https://nvd.nist.gov/vuln/detail/CVE-2025-65036